blister | fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 18:11

Target

fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe
Size

442KB
MD5

1fc1474748659cba880dd52ebc05fc5a
SHA1

3c43f5b327ee4d985ef39528d707cc2ceb97c86f
SHA256

fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd
SHA512

8f9efa239e55c0261f5690481b8226b159f956aaca0d2b635be83bd09f4f28a31e9ba2f647aea0a2b8a65f293bc0747f5c9c954cfae6ef7ab3d29dbffc4441a2
SSDEEP

12288:dsOol4Xi9t0za9jFUA4lAk3H/+414qgUbNDx99H:dyxrvU3m414qgUj99H

Score

10^/10

blister loader

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x64 2 IoCs

loader

Processes:

resource	yara_rule
behavioral2/files/0x0007000000022e1b-132.dat	family_blister_x64
behavioral2/memory/2268-133-0x00007FFE4F3E0000-0x00007FFE4F485000-memory.dmp	family_blister_x64

Loads dropped DLL 1 IoCs

Processes:

fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe

pid	Process
2268	fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe
"C:\Users\Admin\AppData\Local\Temp\fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe"
1⤵
- Loads dropped DLL
PID:2268

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\sppcommdlg_64\sppcommdlg.dll

Filesize
645KB

MD5
3c5c693ba9b161fa1c1c67390ff22c96

SHA1
d829cc3b86c2238d1da3f5f0c07c13c5e7c5fcfc

SHA256
b062dd516cfa972993b6109e68a4a023ccc501c9613634468b2a5a508760873e

SHA512
3fa154a7b35a0187b854fc38825860cd259d294b0c9615b35a82293d52114163dcde02a8aafddde2144ef922b5dc064393ae835f184eadcc96d34b2119909e97

Download Submit
memory/2268-133-0x00007FFE4F3E0000-0x00007FFE4F485000-memory.dmp

Filesize
660KB

Download